Re: [spfbis] SPF-checking tool

["Frank Bulk" <[e-mail]>]

Perhaps I'm using an old version of that Python script, but here are some
examples.  My best guess is that the python script stops as soon as it
passes the check, but doesn't evaluate the whole record.


deerequipment.com: Dmarcian notes "The target name for
"include:spf.protection.outlook.com" equals an already evaluated "include"
mechanism / "redirect" modifier." 

visionnetusa.com: Dmarcian notes "Multiple SPF records found for
"visionnetusa.com". There should only be one."

ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for
"ghekkonetworks.com". There should only be one."

billtrust.com: Dmarcian notes " A DMARC record was detected under
"billtrust.com". DMARC records must be located at "_dmarc.billtrust.com",
and not directly at "billtrust.com". If DMARC was set up as a wildcard
record, that should be removed and placed only at the domain level."

zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF
record. The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
ip4:66.202.101.250 ip4:65.114.230.67 ip4:64.179.27.250 ip4:64.196.161.5
ip4:13.111.0.0/23 ip4:64.18.0.0/20 ip4:64.151.112.128/28
ip4:64.151.119.32/27 ip4:64.233.160.0/19 ip4:64.235.144.0/20
ip4:66.102.0.0/20 ip4:66.231.95.0/29 ip4:66.249.80.0/20 ip4:67.59.141.128/28
ip4:64.125.230.136/32 ip4:69.43.143.32/27 ip4:69.43.143.96/27
include:spf-0024b301.pphosted.com include:email-od.com
include:_spf.salesforce.com include:_spf.google.com include:aspmx.pardot.com
include:_spf.q4press.com ~all" 66.202.101.250 [e-mail]
mail.zayo.com
result: ('pass', 250, 'sender SPF authorized') ip4:66.202.101.250
root@nagios:/usr/local/bin/spfcheck#

nocix.net: Dmarcian notes "16 DNS lookups required to evaluate the SPF
record. The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a
ip4:204.152.38.69/32 ip4:204.152.38.70/32 ip4:204.152.38.77/32
ip4:204.152.38.72/32 a:s101.ndevix.com a:s101.chi.ndevix.com
a:s102.ndevix.com a:s105.ndevix.com a:f0.mx.ndevix.com a:f102.mx.ndevix.com
include:ndevix.com -all" 204.152.38.87 [e-mail] mail.nocix.net
result: ('pass', 250, 'sender SPF authorized') mx
root@nagios:/usr/local/bin/spfcheck#

tivo.com: Dmarcian notes:
	Error! 30 DNS lookups required to evaluate the SPF record. The
maximum is 10.
	Error! SPF record is present, but invalid.
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com
include:spf.protection.outlook.com include:aspmx.pardot.com
include:_spf.centercode.com ~all" 204.176.49.0 [e-mail]
mail.tivo.com
result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com
root@nagios:/usr/local/bin/spfcheck#

nex-tech.com: Dmarciate notes: "SPF record is present, but invalid."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25
ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170
include:amazonses.com a:dispatch-us.ppe-hosted.com
include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com
include:azure.quotevalet.com include:spf.protection.outlook.com a -all"
208.65.144.0 [e-mail] mail.nex-tech.com
result: ('pass', 250, 'sender SPF authorized') ip4:208.65.144.0/21
root@nagios:/usr/local/bin/spfcheck#

atx.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF record.
The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
include:spf.protection.outlook.com include:aspmx.pardot.com
include:salesforce.com -all" 40.92.0.0 [e-mail] mail.atx.com
result: ('pass', 250, 'sender SPF authorized')
include:spf.protection.outlook.com
root@nagios:/usr/local/bin/spfcheck#

lewisdrug.com: Dmarciante notes:
	Error! 13 DNS lookups required to evaluate the SPF record. The
maximum is 10.
	Error! SPF record is present, but invalid.
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a
ip4:216.12.181.71/32 ip4:216.12.181.72/32 include:_spf.google.com
include:spf.createsend.com include:_netblocks.mimecast.com ~all"
207.211.30.221 [e-mail] mail.lewisdrug.com
result: ('pass', 250, 'sender SPF authorized') mx
root@nagios:/usr/local/bin/spfcheck#


Frank 

-----Original Message-----
From: Stuart D Gathman <[e-mail]> 
Sent: Thursday, February 27, 2020 1:36 AM
To: Frank Bulk <[e-mail]>
Cc: [e-mail]
Subject: Re: [spfbis] SPF-checking tool

On Wed, 26 Feb 2020, Frank Bulk wrote:

> I currently use kitterman's script, but it doesn't catch all the issues
that
> Dmarcian does and so there's a number of domains that have issues but I'm
> not alerting on them. Dmarcian doesn't appear to have an API or
downloadable
> version of their tool that I can run.

Are you checking DMARC, or SPF?

If SPF, can you give an example of an incorrect policy that is not
flagged?